kolega-code 0.41.2__tar.gz → 0.41.3__tar.gz

{kolega_code-0.41.2 → kolega_code-0.41.3}/CHANGELOG.md

@@ -6,6 +6,27 @@ This project uses GitHub Releases for detailed generated release notes. This fil
 
 ## Unreleased
 
+## 0.41.3 - 2026-10-05
+
+### Fixed
+
+- The Settings screen no longer loses unsaved work. Leaving a section or
+  closing Settings with pending MCP server edits now offers Save, Discard, or
+  Keep Editing, and a failed save or verification keeps the form exactly as
+  entered, including values the form does not expose (connection timeouts,
+  OAuth fields).
+- Scrolling inside a Settings dropdown no longer scrolls the page beneath it,
+  and choosing an option keeps the page position and focus stable.
+- Saving Settings or switching modes while an agent turn is running no longer
+  disrupts the active turn; queued turns are deferred and preserved.
+- Tool titles containing a trailing backslash or an unmatched square bracket no
+  longer crash the transcript renderer.
+
+### Security
+
+- Updated PyJWT to 2.15.0, urllib3 to 2.8.0, and virtualenv to 21.7.13 to
+  close known CVEs in those dependencies.
+
 ## 0.41.2 - 2026-09-30
 
 ### Fixed

{kolega_code-0.41.2 → kolega_code-0.41.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kolega-code
-Version: 0.41.2
+Version: 0.41.3
 Summary: Multi-agent coding in the terminal
 Project-URL: Homepage, https://kolega-ai.github.io/kolega-code/
 Project-URL: Documentation, https://kolega-ai.github.io/kolega-code/
@@ -35,7 +35,7 @@ Requires-Dist: cryptography==48.0.1; sys_platform == 'darwin' and platform_machi
 Requires-Dist: cryptography==50.0.0; sys_platform != 'darwin' or platform_machine != 'x86_64'
 Requires-Dist: ddgs==9.14.4
 Requires-Dist: fastapi==0.139.2
-Requires-Dist: filelock==3.20.3
+Requires-Dist: filelock==3.24.2
 Requires-Dist: firecrawl-py==4.28.2
 Requires-Dist: google-genai==2.12.1
 Requires-Dist: httpx==0.28.1
@@ -57,6 +57,7 @@ Requires-Dist: playwright==1.59.0
 Requires-Dist: psutil==7.2.2
 Requires-Dist: pydantic==2.13.4
 Requires-Dist: pygments==2.20.0
+Requires-Dist: pyjwt==2.15.0
 Requires-Dist: pypdfium2==5.11.0
 Requires-Dist: python-dotenv==1.2.2
 Requires-Dist: pyyaml==6.0.3
@@ -67,6 +68,7 @@ Requires-Dist: tenacity==9.1.4
 Requires-Dist: textual==8.2.5
 Requires-Dist: tiktoken==0.12.0
 Requires-Dist: trafilatura==2.0.0
+Requires-Dist: urllib3==2.8.0
 Requires-Dist: uvicorn==0.49.0
 Requires-Dist: websockets==16.0
 Provides-Extra: cli
@@ -80,6 +82,7 @@ Requires-Dist: pytest-xdist==3.8.0; extra == 'dev'
 Requires-Dist: pytest==9.0.3; extra == 'dev'
 Requires-Dist: ruff==0.15.12; extra == 'dev'
 Requires-Dist: twine==6.2.0; extra == 'dev'
+Requires-Dist: virtualenv==21.7.13; extra == 'dev'
 Provides-Extra: tinker
 Requires-Dist: tinker-cookbook==0.5.4; extra == 'tinker'
 Requires-Dist: tinker==0.25.0; extra == 'tinker'

{kolega_code-0.41.2 → kolega_code-0.41.3}/kolega_code/__init__.py

@@ -174,4 +174,4 @@ __all__ = [
     "parse_git_status_output",
 ]
 
-__version__ = "0.41.2"
+__version__ = "0.41.3"

{kolega_code-0.41.2 → kolega_code-0.41.3}/kolega_code/agent/__init__.py

@@ -51,4 +51,4 @@ __all__ = [
     "ToolExtension",
 ]
 
-__version__ = "0.41.2"
+__version__ = "0.41.3"

{kolega_code-0.41.2 → kolega_code-0.41.3}/kolega_code/cli/app.py

@@ -1373,7 +1373,11 @@ class KolegaCodeApp(
         event.composer.load_text("")
         self._pending_image_attachments.clear()
         self._clear_composer_hint()
-        if self._turn_active or self.agent_worker is not None:
+        if (
+            self._turn_active
+            or self.agent_worker is not None
+            or (self._settings_screen is not None and self._settings_screen.mcp_busy)
+        ):
             self._queue_user_message(text, attachments)
             return
         self._add_conversation_entry(tui_state.ConversationEntry(kind="user", content=text))
@@ -1559,6 +1563,9 @@ class KolegaCodeApp(
                 pass
 
     def _mode_switch_blocked(self) -> bool:
+        if self._settings_screen is not None and self._settings_screen.mcp_busy:
+            self._notify_user("Wait for the MCP operation to finish before switching modes.", severity="warning")
+            return True
         if self._pending_approval is not None:
             self._set_composer_status(messages.APPROVAL_PLACEHOLDER)
             self._notify_user(messages.BLOCK_PENDING_APPROVAL, severity="warning")

{kolega_code-0.41.2 → kolega_code-0.41.3}/kolega_code/cli/tui/agent_runtime.py

@@ -926,6 +926,9 @@ class AgentRuntimeMixin(tui_app_base.KolegaAppBase):
             self._maybe_start_queued_message()
 
     def _maybe_start_queued_message(self) -> bool:
+        settings_screen = getattr(self, "_settings_screen", None)
+        if settings_screen is not None and settings_screen.mcp_busy:
+            return False
         if self._startup_pending or not self._queued_messages or self.agent is None:
             return False
         if self._turn_active or self.agent_worker is not None:
@@ -1238,7 +1241,14 @@ class AgentRuntimeMixin(tui_app_base.KolegaAppBase):
         self.session.config = config_summary(config)
         await self._save_session_async()
         try:
-            await self._build_agent(config, rebuild=rebuild)
+            settings_screen = getattr(self, "_settings_screen", None)
+            await self._build_agent(
+                config,
+                rebuild=rebuild,
+                # Peer messages may arrive while an MCP operation awaits OAuth
+                # or a remote server. Resume them against the rebuilt agent.
+                preserve_queued=settings_screen is not None and settings_screen.mcp_busy,
+            )
         except KolegaExtensionLoadError as exc:
             # The failed generation was already reclaimed by _build_agent; there
             # is no live agent, so surface the error instead of crashing the

{kolega_code-0.41.2 → kolega_code-0.41.3}/kolega_code/cli/tui/loop_runtime.py

@@ -216,8 +216,10 @@ class LoopRuntimeMixin(tui_app_base.KolegaAppBase):
 
     def _loop_ready_to_fire(self) -> bool:
         """Whether the app is idle enough to start a scheduled iteration."""
+        settings_screen = getattr(self, "_settings_screen", None)
         return (
             self.agent is not None
+            and not (settings_screen is not None and settings_screen.mcp_busy)
             and not self._loop_iteration_active
             and not self._turn_active
             and self.agent_worker is None

{kolega_code-0.41.2 → kolega_code-0.41.3}/kolega_code/cli/tui/settings_panel.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import json
 import os
 import re
@@ -49,7 +50,7 @@ from kolega_code.mcp.config import (
     remove_server_config,
     upsert_server_config,
 )
-from kolega_code.mcp.service import MCPService, mcp_tool_name_adjustment_note
+from kolega_code.mcp.service import MCPService, MCPVerificationResult, mcp_tool_name_adjustment_note
 from kolega_code.mcp.state import MCPStatusStore, MCPOAuthTokenStore
 
 from .. import messages, theme
@@ -416,8 +417,15 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             self._update_endpoint_field_visibility()
             return
 
+        if select_id and select_id.startswith("mcp_") and event.select.value != event.value:
+            return  # Ignore queued values superseded by form loading or picker restoration.
+
         if select_id == "mcp_server_select":
-            self._populate_mcp_server_form(str(event.value))
+            screen = getattr(self, "_settings_screen", None)
+            if screen is not None:
+                screen.request_mcp_selection(str(event.value))
+            else:
+                self._populate_mcp_server_form(str(event.value))
             return
 
         if select_id == "mcp_transport_select":
@@ -1444,7 +1452,7 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             self.config.mcp_config = config
         return config
 
-    def _populate_mcp_controls(self) -> None:
+    def _populate_mcp_controls(self, *, preserve_form: bool = False) -> None:
         """Seed the MCP settings controls from global/trusted project config and status."""
         try:
             config = self._load_mcp_config_for_ui()
@@ -1462,7 +1470,8 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             selected = MCP_NEW_SERVER_VALUE
         server_select.set_options(options)
         server_select.value = selected
-        self._populate_mcp_server_form(selected)
+        if not preserve_form:
+            self._populate_mcp_server_form(selected)
         self._update_mcp_status_text(config)
 
     def _mcp_server_option_label(self, server: MCPServerConfig) -> str:
@@ -1509,6 +1518,9 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             set_input("mcp_cwd_input", "")
             self._set_mcp_source_hint("Create or update a user MCP server in the global state config.")
             self._update_mcp_transport_fields("streamable_http")
+            screen = getattr(self, "_settings_screen", None)
+            if screen is not None:
+                screen.mark_mcp_clean(server_id)
             return
 
         set_input("mcp_name_input", server.name or "")
@@ -1534,6 +1546,9 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         else:
             self._set_mcp_source_hint("This server is stored in your global MCP config.")
         self._update_mcp_transport_fields(server.transport)
+        screen = getattr(self, "_settings_screen", None)
+        if screen is not None:
+            screen.mark_mcp_clean(server_id, read_only=server.source == "project")
 
     def _update_mcp_oauth_fields(self, visible: bool) -> None:
         for widget_id in (
@@ -1626,6 +1641,11 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         except NoMatches:
             pass
 
+    def _set_mcp_feedback(self, message: str) -> None:
+        screen = getattr(self, "_settings_screen", None)
+        if screen is not None:
+            screen.set_mcp_feedback(message)
+
     def _slug_mcp_server_id(self, value: str) -> str:
         slug = re.sub(r"[^A-Za-z0-9_-]+", "-", value.strip().lower())
         slug = re.sub(r"-+", "-", slug).strip("-_")
@@ -1740,50 +1760,41 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
             except NoMatches:
                 pass
 
-        client_name = "Kolega Code"
-        client_uri = None
-        client_metadata_url = None
-        timeout_seconds = 300.0
+        # Overlay only the editor's fields on the saved model. Connection timeouts
+        # and OAuth client metadata have no controls and must survive every save.
+        payload: dict[str, Any] = {}
+        oauth_payload: dict[str, Any] = {}
         if selected != MCP_NEW_SERVER_VALUE:
-            try:
-                config = self._load_mcp_config_for_ui()
-                existing = config.servers.get(selected)
-                if existing:
-                    client_name = existing.oauth.client_name
-                    client_uri = existing.oauth.client_uri
-                    client_metadata_url = existing.oauth.client_metadata_url
-                    timeout_seconds = existing.oauth.timeout_seconds
-            except Exception:
-                pass
-
-        oauth = MCPOAuthConfig(
-            enabled=oauth_enabled,
-            client_id=oauth_client_id,
-            client_secret=oauth_client_secret,
-            client_secret_env=oauth_client_secret_env,
-            redirect_uri=oauth_redirect_uri,
-            scope=oauth_scope,
-            token_endpoint_auth_method=oauth_auth_method,
-            client_name=client_name,
-            client_uri=client_uri,
-            client_metadata_url=client_metadata_url,
-            timeout_seconds=timeout_seconds,
-        )
-
-        return MCPServerConfig(
+            existing = self._load_mcp_config_for_ui().servers.get(selected)
+            if existing is None:
+                raise ValueError("This MCP server no longer exists. Reload before saving.")
+            payload = existing.model_dump()
+            oauth_payload = existing.oauth.model_dump()
+        if http:
+            oauth_payload.update(
+                client_id=oauth_client_id,
+                client_secret=oauth_client_secret,
+                client_secret_env=oauth_client_secret_env,
+                redirect_uri=oauth_redirect_uri,
+                scope=oauth_scope,
+                token_endpoint_auth_method=oauth_auth_method,
+            )
+        oauth_payload["enabled"] = oauth_enabled
+        payload.update(
             id=server_id,
             name=name,
             transport=transport,
             enabled=enabled,
             url=url,
             headers=headers,
-            oauth=oauth,
+            oauth=MCPOAuthConfig.model_validate(oauth_payload),
             command=command,
             args=args,
             env=env,
             cwd=cwd,
             source="global",
         )
+        return MCPServerConfig.model_validate(payload)
 
     def _parse_mcp_json_object(self, value: str, label: str) -> dict[str, str]:
         if not value:
@@ -1813,6 +1824,10 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         if button_id == "mcp_save_server":
             await self._save_mcp_server_from_ui()
             return True
+        if button_id == "mcp_save_verify_server":
+            if await self._save_mcp_server_from_ui(rebuild=False):
+                await self._verify_mcp_server_from_ui(just_saved=True)
+            return True
         if button_id == "mcp_delete_server":
             await self._delete_mcp_server_from_ui()
             return True
@@ -1825,13 +1840,19 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         return False
 
     def _selected_mcp_server_id(self) -> str:
+        screen = getattr(self, "_settings_screen", None)
+        if screen is not None:
+            return screen.mcp_server_id
         try:
             value = self._settings_query_one("#mcp_server_select", Select).value
         except NoMatches:
             return MCP_NEW_SERVER_VALUE
         return MCP_NEW_SERVER_VALUE if value is Select.NULL else str(value)
 
-    async def _save_mcp_server_from_ui(self) -> None:
+    async def _save_mcp_server_from_ui(self, *, rebuild: bool = True) -> bool:
+        if self._turn_active or self.agent_worker is not None:
+            self._set_mcp_status("Stop the active turn before changing MCP servers.", "warning")
+            return False
         selected = self._selected_mcp_server_id()
         try:
             server = self._collect_mcp_server_from_ui()
@@ -1844,18 +1865,27 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
                 self._set_mcp_status(
                     "Project MCP servers are read-only in the TUI; edit .kolega/mcp_servers.json.", "warning"
                 )
-                return
+                return False
             path = global_mcp_config_path(self.settings_store.root)
             if selected != MCP_NEW_SERVER_VALUE and selected != server.id:
                 remove_server_config(path, selected, source="global")
             upsert_server_config(path, server, source="global")
         except (MCPConfigError, ValueError) as exc:
             self._set_mcp_status(str(exc), "error")
-            return
+            return False
+        except OSError:
+            self._set_mcp_status("Could not save MCP configuration. Check file permissions and try again.", "error")
+            return False
         self._mcp_selected_server_id = server.id
-        self._populate_mcp_controls()
-        await self._ensure_agent_from_settings(rebuild=True)
+        screen = getattr(self, "_settings_screen", None)
+        if screen is not None:
+            screen.mark_mcp_clean(server.id, message="Saved. Verification has not been run by this action.")
+        self._populate_mcp_controls(preserve_form=True)
+        self._set_mcp_source_hint("This server is stored in your global MCP config.")
+        if rebuild:
+            await self._ensure_agent_from_settings(rebuild=True)
         self._notify_user(f"Saved MCP server '{server.id}'.")
+        return True
 
     async def _delete_mcp_server_from_ui(self) -> None:
         selected = self._selected_mcp_server_id()
@@ -1884,7 +1914,13 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         await self._ensure_agent_from_settings(rebuild=True)
         self._notify_user(f"Deleted MCP server '{selected}'.")
 
-    async def _verify_mcp_server_from_ui(self) -> None:
+    async def _verify_mcp_server_from_ui(self, *, just_saved: bool = False) -> None:
+        screen = getattr(self, "_settings_screen", None)
+        if screen is not None and screen.mcp_dirty:
+            self._set_mcp_status(
+                "Unsaved server changes. Use Save & Verify to test the displayed configuration.", "warning"
+            )
+            return
         selected = self._selected_mcp_server_id()
         if selected == MCP_NEW_SERVER_VALUE:
             self._set_mcp_status("Select a configured MCP server to verify.", "warning")
@@ -1892,16 +1928,25 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
         self._set_mcp_status(
             f"Verifying MCP server '{selected}'... stdio servers execute their configured command.", "warning"
         )
+        self._set_mcp_feedback("Saved. Verifying…" if just_saved else "Verifying saved configuration…")
         config = self._load_mcp_config_for_ui()
-        result = await MCPService(config, self.settings_store.root, self.project_path).verify_server(
-            selected,
-            interactive_oauth=True,
-            open_browser=True,
-            output=self.console,
-        )
-        self._populate_mcp_controls()
+        try:
+            result = await MCPService(config, self.settings_store.root, self.project_path).verify_server(
+                selected,
+                interactive_oauth=True,
+                open_browser=True,
+                output=self.console,
+            )
+        except asyncio.CancelledError:
+            self._set_mcp_feedback("Configuration remains saved. Verification was cancelled.")
+            raise
+        except Exception:
+            # Do not echo arbitrary transport exceptions: they may contain credentials.
+            result = MCPVerificationResult(selected, False, "Verification could not complete. Try again.")
+        self._update_mcp_status_text()
         await self._ensure_agent_from_settings(rebuild=True)
         if result.ok:
+            self._set_mcp_feedback("Saved and verified." if just_saved else "Saved configuration verified.")
             message = f"Verified MCP server '{selected}' ({result.tool_count} tool(s))."
             if result.status is not None:
                 note = mcp_tool_name_adjustment_note(selected, result.status.tools)
@@ -1909,6 +1954,7 @@ class SettingsPanelMixin(tui_app_base.KolegaAppBase):
                     message = f"{message} {note}"
             self._notify_user(message)
         else:
+            self._set_mcp_feedback(f"Saved, but verification failed. {result.message}")
             self._notify_user(f"MCP verification failed for '{selected}': {result.message}", severity="warning")
 
     def _clear_mcp_tokens_from_ui(self) -> None: